{"id":72504,"date":"2011-08-18T07:09:57","date_gmt":"2011-08-18T07:09:57","guid":{"rendered":"https:\/\/localhost\/wordpress\/?p=72504"},"modified":"2011-08-18T07:09:57","modified_gmt":"2011-08-18T07:09:57","slug":"android-malware-disguises-itself-as-google-app","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/android-malware-disguises-itself-as-google-app\/","title":{"rendered":"Android malware disguises itself as Google+ App"},"content":{"rendered":"

We have received a new Android malware from the Anrdoid market whose icon is like a Google+ app.
\nThis app is particularly dangerous as it gathers GPS data, call logs, text messages and even records phone calls before sending the information off to a remote server.<\/p>\n

After installation it asks for the following permissions:<\/p>\n

\"\"
\nPROCESS_OUTGOING_CALLS
\nINTERNET
\nACCESS_GPS
\nACCESS_COARSE_LOCATION
\nACCESS_COARSE_UPDATES
\nACCESS_FINE_LOCATION
\nREAD_PHONE_STATE
\nREAD_CONTACTS
\nWRITE_CONTACTS
\nACCESS_WIFI_STATE
\nPERMISSION_NAME
\nSEND_SMS
\nREAD_SMS
\nRECEIVE_SMS
\nWRITE_SMS
\nWAKE_LOCK
\nRECORD_AUDIO
\nWRITE_EXTERNAL_STORAGE
\nMODIFY_PHONE_STATE
\nDEVICE_POWER
\nACCESS_NETWORK_STATE
\nACCESS_WIFI_STATE
\nMODIFY_PHONE_STATE
\nDISABLE_KEYGUARD
\nWRITE_SETTINGS
\nDELETE_PACKAGES
\nKILL_BACKGROUND_PROCESSES
\nFORCE_STOP_PACKAGES
\nRESTART_PACKAGES
\nWRITE_APN_SETTINGS<\/p>\n

It may then start any of the following services:<\/p>\n

AlarmService
\nCallLogService
\nCallRecordRegisterService
\nCallRecordService
\nCallsListenerService
\nCommandExecutorService
\nContactService
\nEnvRecordService
\nGpsService
\nKeyguardLockService
\nLocationService
\nMainService
\nManualLocalService
\nRegisterService
\nScreenService
\nSendResultService
\nSmsControllerService
\nSmsService
\nSocketService
\nSyncContactService
\nUploadService<\/p>\n

It is also capable of receiving commands via text messages, but it requires the sender to use the pre-defined “Controller” number.<\/p>\n

\"\"<\/p>\n

It also has the capability to automatically answer incoming calls.
\nBefore answering the call, it puts the phone on silent mode to prevent the affected user from hearing it. It also hides the dial pad and sets the current screen to display the home page.<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

As mentioned previously, the best defense against such malware is to pay attention to the permissions the application is asking for.<\/p>\n

Also we have recently released Quick Heal Mobile Security for Android which detects this malware as Android.Nickispy.C.<\/strong>. <\/p>\n

For more information please visit Quick Heal Mobile security<\/a>.<\/p>\n

Thank you Sandeep for the analysis.<\/p>\n","protected":false},"excerpt":{"rendered":"

We have received a new Android malware from the Anrdoid market whose icon is like a Google+ app. This app is particularly dangerous as it gathers GPS data, call logs, text messages and even records phone calls before sending the information off to a remote server. After installation it asks for the following permissions: PROCESS_OUTGOING_CALLS […]<\/p>\n","protected":false},"author":22,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[55,24,60],"tags":[56,57,49,59,61,67],"class_list":["post-72504","post","type-post","status-publish","format-standard","hentry","category-android","category-malware","category-smartphone","tag-android-security","tag-droid-defense","tag-malware","tag-mobile-devices","tag-smartphone-security","tag-third-party-apps"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/72504"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/22"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=72504"}],"version-history":[{"count":0,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/72504\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=72504"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=72504"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=72504"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}